CVE-2025-14299: tp-link systems inc. tapo c200 v3

Vulnerability summary

CVE-2025-14299 is a high (CVSS 7.1) vulnerability in tp-link systems inc. tapo c200 v3. EPSS estimates a 0.24% chance of exploitation in the next 30 days, higher than 14.7% of scored vulnerabilities.

Timeline

1. 20-12-2025
   PublishedVulnerability first disclosed.
2. 22-12-2025
   Last modifiedVulnerability information updated.

Description

The HTTPS server on Tapo C200 V3 does not properly validate the Content-Length header, which can lead to an integer overflow. An unauthenticated attacker on the same local network segment can send crafted HTTPS requests to trigger excessive memory allocation, causing the device to crash and resulting in denial-of-service (DoS).

• CWE-770Allocation of Resources Without Limits or ThrottlingThe product allocates a reusable resource or group of resources on behalf of an actor without imposing any intended restrictions on the size or number of resources that can be allocated.
• CWE-190Integer Overflow or WraparoundThe product performs a calculation that can produce an integer overflow or wraparound when the logic assumes that the resulting value will always be larger than the original value. This occurs when an integer value is incremented to a value that is too large to store in the associated representation. When this occurs, the value may become a very small or negative number.